Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS • Hacker News Board

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#221

Post by AlotOfReading » Mon, Jul 13, 2026, 4:27 PM UTC

hilariously wrote: post #212

AlotOfReading wrote: post #75

Earlier quoted context omitted.

As I said, floats can provide results that are no worse than a specified fixed point type. So if you want uniform absolute precision, just round down to the required precision. Floating point is generally deterministic in practice with a fairly minor amount of effort, the major remaining issue being library rounding. I actually wrote a library that guarantees this for arbitrary code, with some small, obvious caveats…

Totally fair if you have full control, my experience is often with databases where you can get warnings that float implementations can even change per-operating system (thanks MySQL) or per query plan (based on plan ordering) which is ... pretty bad!

I don't know much about real query planners, but if I understand what you're saying there may be ways to improve the situation.

If you stick to the safe bits I've been discussing elsewhere in this thread and your platforms implement IEEE floats, float math will also be commutative + associative and you won't have to deal with precision loss. That means your usable range will be narrower than the same size fixed type (because it's limited by the mantissa) but it's large enough to still be useful.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#222

Post by Asraelite » Mon, Jul 13, 2026, 5:14 PM UTC

NetMageSCW wrote: post #218

Asraelite wrote: post #79

Earlier quoted context omitted.

Permission to access is not the same as permission to use.

Reading is using.

No it's not. There is a legal distinction in IP law between the act of observing information and the act of using that information for some kind of personal gain.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#223

Post by pocksuppet » Mon, Jul 13, 2026, 5:39 PM UTC

esrauch wrote: post #113

nradov wrote: post #101

Earlier quoted context omitted.

The HTTP User-Agent header was a mistake from the beginning. There is no legitimate need for the server to know what software the client is (or claims to be) running.

I feel like this is with 2026 view where browsers are so mutually compatible. In the bad old days there were so many differences between html, css and js behaviors that if you wanted your site to be nice you had to change it for the browser. The way css padding worked wasn't even the same. Feature detection was rarely viable for any of this. No user agent would probably have only entrenched IE6 dominance even more by…

> browsers are so mutually compatible.

Not really, there's just only one browser (Chrome). Firefox has declined so low it's a rounding error, and all other browsers are Chrome forks.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#224

Post by 1vuio0pswjnm7 » Mon, Jul 13, 2026, 5:49 PM UTC

1vuio0pswjnm7 wrote: post #177

nradov wrote: post #101

Earlier quoted context omitted.

The HTTP User-Agent header was a mistake from the beginning. There is no legitimate need for the server to know what software the client is (or claims to be) running.

"The HTTP User-Agent header was a mistake form the beginning." User-Agent spoofing was added to NCSA Mosaic in 1996. The public www was three years old and text-only clients were still in widespread use https://raw.githubusercontent.com/alandipert/ncsa-mosaic/mas... NCSA Mosaic is the early graphical browser that begat Netscape Navigator that begat Firefox. Later came Internet Explorer, Safari, Chrome and so on What…

NB. Akamai does not require any specific value for the User-Agent header nor the presence of this header

For example, https://www.apple.com does not require a UA header

For example, http://www.slackware.com does not require a UA header. However, it does require Accept and Accept-Encoding headers

This site can also be accessed over HTTPS

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#225

Post by chrismorgan » Mon, Jul 13, 2026, 6:23 PM UTC

NetMageSCW wrote: post #217

chrismorgan wrote: post #190

Earlier quoted context omitted.

When distributing software, it’s very useful to know which OS and which architecture the user is on in order to present them with the appropriate file.

Or you could let the user decide since you have no idea what system they want to execute the software on, just what system they are using to browse your site.

The overwhelming majority of the time (typically far higher than 99% of the time), if they hit a download button, they want it for their current platform.

And detecting their platform doesn’t stop you from presenting supplemental links for all platforms. In fact I’d say that’s completely normal.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#226

Post by cute_boi » Mon, Jul 13, 2026, 6:32 PM UTC

If you want ppl like me to read your article, please stop writing like 80% of text on AI. Use it to correct grammar, typos, and similar issues, but please do not use it to write the whole article.

However, thank you for the information.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#227

Post by cute_boi » Mon, Jul 13, 2026, 6:33 PM UTC

Aurornis wrote: post #8

> One tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent. They (or rather the LLM that wrote this) missed that this is possibly fingerprintable to browser version range, which is slightly more interesting. Most users aren't spoofing their user agent headers to be a different operating system. Most fingerprinting solutions aren't tryin…

After reading this I am sure 90% of text is from AI. This is so annoying to read.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#228

Post by cute_boi » Mon, Jul 13, 2026, 6:40 PM UTC

fn-mote wrote: post #183

0xbadcafebee wrote: post #166

Earlier quoted context omitted.

> we see customers that are constantly burned by abusive scrapers and the scrapers aren't slowing down So, I have two dumb questions: 1) Can't the customer rate-limit connections? If the "abuse" in scraping is the number of requests... limit the number of requests? 2) There is probably a market now for federated authentication where the provider gives legal guarantees of anonymized fingerprint in exchange for either…

> Can't the customer rate-limit connections? Bad guys use a botnet (compromised residential computers and routers) to defeat rate limiting and ip-based blocking.

Recently there was a article where LG smart tv were hacked and used for this entire thing.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#229

Post by 1vuio0pswjnm7 » Mon, Jul 13, 2026, 8:36 PM UTC

Chu4eeno wrote: post #213

1vuio0pswjnm7 wrote: post #177

Earlier quoted context omitted.

"The HTTP User-Agent header was a mistake form the beginning." User-Agent spoofing was added to NCSA Mosaic in 1996. The public www was three years old and text-only clients were still in widespread use https://raw.githubusercontent.com/alandipert/ncsa-mosaic/mas... NCSA Mosaic is the early graphical browser that begat Netscape Navigator that begat Firefox. Later came Internet Explorer, Safari, Chrome and so on What…

I take it you either have a godly IP reputation, or you don't hit 90% of the current internet which is behind cloudflare, google, akamai, etc? They're pretty brutal in blocking non-browsers, I tend to have to add a lot of useless headers.

According to their /clientrep-lookup database the IP address I am using has no reputation

Blocking "non-browsers" and blocking IP addresses are two different things, so to speak

The first is based on dumb heuristics and (incorrect) assumptions about behavior based on what software someone is (mistakenly) presumed to be using

The second is based on past behaviour

I send the minimum HTTP headers

I only request what I want; I do not send requests for ads, tracking or telemetry

I accept text formats, e.g., HTML, JSON, etc.

No need for images, CSS, Javascript, etc.

Re: Since Chromium 148, Math.tanh is now fingerprintable to link underlying OS

#230

Post by pocksuppet » Mon, Jul 13, 2026, 8:56 PM UTC

lixtra wrote: post #153

matheusmoreira wrote: post #136

Earlier quoted context omitted.

> at scale, to the degree that you're taking down my site Fair. Scrapers should be polite and do their utmost to consume the smallest possible amount of resources. > without my consent by masking your user-agent Your consent is not required. It's my user agent. I set it to whatever I want. > for the purpose of stealing data I didn't authorize you to have Data can't be "stolen", only copied. You set up an HTTP server…

> You set up an HTTP server that literally sends people the data when they request it. Don't do that if you don't want people to have the data. By the same argument I could say: If I send you an exploit and you execute it, don’t complain that your setup fell for it. Just don’t download and run random data from the internet. In reality there’s a consent and expectation beyond the pure technicals.

The expectation with scraping is that you won't cause excessive server load. The "AI" scrapers are not respecting that. But there are plenty of other scrapers that do.

Here's some stuff on Adversarial Interoperability, which is an incredibly good thing that can reverse enshittification if it becomes more widespread: https://www.eff.org/deeplinks/2019/10/adversarial-interopera...